How to Fill Out a Chain of Custody Form (With Example)

A chain-of-custody form documents the life of an evidence item so that, later, anyone can reconstruct exactly where it has been. The form is simple; filling it out completely and contemporaneously is what makes it defensible. Here is what each part is for.

1. Item identification

Give the item a unique identifier and a plain-language description. Tie it to the matter with a case or matter number. The description should be specific enough that no one could confuse this item with another — make, model, serial number, color, distinguishing marks.

2. Collection details

Record who collected the item, their title and organization, and the date, time, and location of collection. Note the condition of the item when collected (sealed, damaged, powered on/off). If collection was authorized by a warrant, consent, or other legal authority, record it — this connects the custody chain to the lawfulness of the seizure.

3. For digital evidence: acquisition details

Digital items need more. Record:

• The acquisition method — physical image, logical extraction, live acquisition
• The tool used and its version
• The source device the data came from
• The acquisition hash and algorithm (for example, SHA-256), computed at the moment of acquisition

The hash is the single most important field for digital evidence: it is what lets you later prove the data hasn't changed.

4. Transfers of custody

Every time the item changes hands, record it as a two-party event: who released it, who received it, the date and time, and the purpose of the transfer. Both parties should acknowledge the handoff. This is where paper forms most often fail — a transfer happens but no one fills in the line, creating a gap.

5. Storage

Between transfers, record where the item was stored and how access was controlled — evidence locker, safe, access-controlled server. Storage without access control is a common weak point.

A short worked example

Item: IMG-0001 — Apple iPhone 14, black, IMEI 3556…

Case: 2026-CR-0042

Collected by: Det. A. Rivera, Metro PD, on 2026-06-10 09:14 at 214 Main St, pursuant to search warrant #W-2026-118. Condition: powered off, undamaged.

Acquisition: Logical extraction via [tool], v7.6. Source: the seized iPhone. SHA-256: 9f2c…a1. Acquired 2026-06-10 14:02.

Transfer 1: Released by Det. Rivera; received by Examiner L. Chen, Digital Forensics Unit, 2026-06-10 14:30, for examination.

Each line is specific, timestamped, and attributable.

The mistakes that create a break

• Blank transfer lines — an item moved but no one recorded it
• Non-contemporaneous entries — filled in "from memory" later
• No integrity value for digital evidence
• Vague descriptions that could match more than one item
• Editable records with no protection against back-dating

Why tamper-evidence matters

Even a perfectly completed paper form has one weakness: nothing about the paper proves it wasn't rewritten afterward. A tamper-evident system removes that doubt by sealing each entry cryptographically. CustodyTrack captures every field above and links each custody event into a hash chain, so the record proves its own integrity — and anyone can verify it for free with the verification code.